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Abstract 



We present a quantum algorithm which identifies with certainty a hidden sub- 
group of an arbitrary finite group G in only a polynomial (in log \ G\) number of 
calls to the oracle. This is exponentially better than the best classical algorithm. 
However our quantum algorithm requires exponential time, as in the classical case. 
Our algorithm utilizes a new technique for constructing error-free algorithms for 
non-decision problems on quantum computers. 

1 Introduction 

Let G be a finite group, written multiplicatively with identity 1q- A function / on G 
(with arbitrary range) is said to be H-periodic if / is constant on the left cosets of a 
subgroup H of G. If / also takes distinct values on distinct cosets we say / is strictly 
iJ-periodic and we call H the hidden subgroup of /. The hidden subgroup problem 
(HSP) is stated as follows: Given a description of G and a function / on G that is 
promised to be strictly H -periodic for some subgroup H ^ G, find a generating set 



Let r denote the number of distinct subgroups of G. Fix any ordering of the r 
subgroups (Ki, K2, ■ ■ . , K r ) satisfying that {K^l > l-K^+il for all 1 < /1 < r. In the 
HSP, we are searching for a generating set for one out of r candidate subgroups. Let 
N = \G\ denote the order of G. We consider n = log \G\ to be the input size. Since 
any subgroup of G is generated by a set of at most n elements of G, the number r of 
distinct subgroups of G is 2°(™ 

We assume the function / is given as an oracle so that the only way we can gain 
knowledge about / is by asking for its value on elements of G. Formally, on a quantum 
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computer, the oracle is a unitary operator 0/, that maps \g)\Q) to \g)\f(g)} for all 
g € G. We assume without loss of generality that algorithms for the HSP always 
output a subset of H . Suppose instead that an algorithm outputs X % H. Then we can 
find the intersection of X with H by evaluating / on each element x G X and only 
keeping x if f(x) — f(lc)- This requires at most \X\ + 1 evaluations of /. 

If the group G is Abelian, then it is possible to solve the HSP in polynomial time 
with bounded error on a quantum computer. That is, we can efficiently find a subset 
X C H that generates H with probability at least |. This result follows from the work 
of Simon 1 1 1, Shor |2| and Kitaev It is possible to improve the success probability 
to one for Abelian groups of smooth order |4| (a group is of c-smooth order if all prime 
factors of \G\ are at most (log \G\) C for some constant c). For non-Abelian groups, our 
knowledge is much more limited l5ll6ll71l8ll9lfT0l. 

The efficient HSP algorithm for Abelian groups of smooth order implies that only 
a polynomial (in log \G\) number of calls to the oracle are necessary to identify H with 
certainty. The main result of this paper is that this more limited result holds for all 
groups of finite order. That is, there exists a quantum algorithm that determines H 
using a polynomial number of calls to the oracle. 

Theorem 1 There exists a quantum algorithm that, given a finite group G and an 
oracle f on G promised to be strictly H -periodic for some subgroup H ^ G, calls 
the oracle 0(log 4 \G\) times and outputs a generating set for H. The algorithm fails 
with probability exponentially small in log \G\. The algorithm can be made exact in 
any model allowing arbitrary one-qubit gates. 

An important consequence of this result is that it rules out most known methods 
for proving super-polynomial lower bounds on the total complexity of bounded-error 
quantum algorithms for the HSP. Most of these methods bound the query complexity, 
including the recent ones by Aaronson 1 11 1 and Shi 111 21 . This works well for prob- 
lems where the query complexity is at most poly-logarithmically smaller than the time 
complexity. Because of our result, one cannot obtain super-polynomial lower bounds 
on the total complexity of algorithms for the HSP by bounding the query complexity. 

Our result extends to exact quantum algorithms (algorithms that determine the an- 
swer with certainty) in any model that allows arbitrary one-qubit gates. If allowing 
only a restricted set of one-qubit gates, our work leaves a hope that one may be able to 
prove a super-polynomial lower bound on the query complexity for the exact case. 

A proof of the upper bound on the query complexity only requires establishing the 
existence of a sufficiently short sequence of unitary operations and oracle calls on ap- 
propriately chosen quantum systems. The sequence depends on the group. Our proof 
explicitly constructs the sequence and makes it apparent how to realize the unitary op- 
erations using quantum gates from a universal set. In fact, the sequence can be obtained 
by means of a (classical) preprocessing algorithm with input a specification of G and 
whose output is the required sequence of gates and oracle calls. For solving the HSP 
exactly, the classical preprocessing algorithm requires exact real number arithmetic and 
access to trigonometric functions of rational angles. The preprocessing algorithms and 
the quantum networks they compute are inefficient. 
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2 The algorithm 



Our proof of Theorem^consists of two stages. In subsection l2.ll we give a quantum 
algorithm that identifies the correct subgroup with exponentially small error probabil- 
ity, and in subsection 12.21 we then show how to reduce the error probability to zero. 
We begin with an overview. 

We use 2 + 2s registers, where s is a positive integer that will be chosen to achieve 
sufficiently low error probability. The first register is the output register and contains an 
integer v (a subgroup index) between and r. The second register is used as a counter 
and contains an integer I between and r. The remaining 2s registers are grouped in s 
blocks, each consisting of 2 consecutive registers (a "couplet") called the "subgroup" 
and the "function" register. Within each couplet, the first register contains an element 
of G and the second a value in the range of /. 

We start by creating the initial state 



This superposition can be created efficiently using s applications of operator 0/. We 
then apply the unitary operator Test, to be defined in subsection 12. II producing the 
superposition |^fi n ai) = Test^init). We measure the first register of j^flnai), yield- 
ing some subgroup-index v as outcome. If 1 < v < r, we output a generating set 
for K v , otherwise we output {Ig}* which may be the wrong answer. Our algorithm 
has exponentially small error probability. 

Theorem 2 Let Vmh\K v \hV\ denote the probability that the outcome of the measure- 
ment of the first register of I'J'finai) is v, conditioned on the hidden subgroup being H. 
Then Prob[_ff \H] > 1 — 4r /2 s / 2 for all subgroups H ^ G, where r is the number of 
subgroups of G and s is the number of queries. In particular, for s G 0(n 2 + log(l/e)), 
the algorithm outputs the correct subgroup with probability at least 1 — 1/e. 

The theorem is proved in subsection l2.ll and in subsection l2.2l we make this algo- 
rithm exact by precomputing Prob[i^|iJ] for each subgroup pair (K, H), adjusting the 
conditional probabilities to make them more uniform and applying amplitude amplifi- 
cation 1131 . 

2.1 An algorithm with exponentially small error probability 

A (left) translation for a subgroup K of G is a subset T C G so that any element 
g E G can be written uniquely in the form g = tk for some t € T and k £ K. Fix a 
translation T M for each of the r subgroups of G. 

The operator Test tests the hidden subgroup for each of the r candidate subgroups, 
one by one. It is defined by 




(1) 



Test 



Test r 



Test2 • Test 



(2) 
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where each Test p is a unitary operator that tests whether / is J^-periodic. If a function 
is iT-periodic, it is also If -periodic for any proper subgroup K' of K, so we test for 
bigger subgroups first by requiring that \K^\ > l-K^+il for all 1 < fi < r. When we 
find that / is if M -periodic for some subgroup K^, we record this in the first register, 
and we begin counting in the second register. For every subgroup ^ G, let Q M be 
any unitary operator acting on the first two registers that satisfies 



|0)|0) - 

\v)\£) i ^ \v)\£ + l), if£>0. 





Once the count £ in the second register is increased from its initial value of to 1, the 
contents of the first register are never changed. The purpose of the counter is to ensure 
unitarity and that once some test succeeds, no future test affects the contents of the first 
register. 

We test for iT M -periodicity by acting on the s couplets. If function / is K^- 
periodic then the s subgroup registers are in a superposition of the coset states 
\tKfj) = , 1 ^2keK 1^)- Let Ps,n be the projector of the s couplets defined by 



p S)|1 = ( y \tK M ){tK 



where I denotes the identity operator, and let P^- denote its complement. Define 
operator Test M by 

Test^ = Q M <8> P S , M + I $ P^, (3) 

which is unitary by construction. Its effect is an application of Q M on the first two 
registers, conditioned on having the s subgroup registers in coset states of K^. The 
condition can be implemented with the help of any pair of unitary operators U M and 
V M , where maps \1q) to \K^) and V M maps \t)\k) to |lc)|ffc) for all t € T M 
and k G K^. The procedure is as follows: Adjoin an ancilla register to each subgroup 
register and apply to these s register pairs. Then apply to the subgroup registers. 
Next, coherently apply Q M if all subgroup registers are in |1g) and finally reverse the 
previous steps. It is possible to realize each of these steps with a network of gates of 
complexity polynomial in N and s. 

Lemma 3 Iff is K ^-periodic, then 

1.9)1/(5)) J • 

Proof We assume in the lemma that / is -periodic, that is, fit) = f(tk) for all t £ 
T M and k G K„ t and hence the state J2 g£G \g) \f(g)) = ^ £ t6 ^ |ttf M ) \f(t)) 
is in the +l-eigenspace of Pi. p. It follows that P Stfi acts as the identity on the s 
couplets, and thus applying operator Test M as defined in Eq.[5]on the initial state |^imt) 
yields the state given on the right hand side in the equation of the lemma. □ 
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Since we iterate through r tests, we require that if / is not .K^ -periodic, then the 
state is so marginally altered that it is safe to continue to test for K^ + i -periodicity. 

Lemma 4 If f is not K ^-periodic, then the distance (Test M | ^init) ) — | 'i'init) is at most 

i 

Proof Let H denote the hidden subgroup of /. Consider the case s = 1. Then 

\p s jH)\f(H))\ 2 = m,\H)\ 2 = k*^i#>i 2 

teT M teT^-.tK^nH^V) 
= (\H\/\K» n H\)\K„ n Hf/(\K„\\H\) = \K„ n H\/\K, t \ < X -. 

It follows that for arbitrary s, the amplitude squared of (Q M ® P SiAi )|\&init) is up- 
per bounded by (^) s . Since Test M acts trivially on the orthogonal component 
® P^/Jl^init), the result follows. □ 

For each 1 < j < r, let \^>j) = Test, TestjJ'I'jnit) denote the state of the 

system after j tests. By the above lemma, it is safe to iterate through all tests, since 
distances can add up only linearly. 

Lemma 5 Iff is not K ^-periodic for any 1 < p < j, then the distance | — l^init) | 
is at most . 

Suppose that the input function / is strictly if^ -periodic. Then, by Lemma|5J the 
state l^jz-i) just prior the test Test,, is at most at a distance e = ^ttt away from the 
initial state l^init)- Thus the probability that test Test„ fails in producing the correct 
answer \ v) in the first register is at most 2e = by Lemma[3] 

We note that operator Test never acts on the s function registers. One can therefore 
measure these prior to the application of Test without affecting the error probability 
of the bounded error algorithm. However, our exact algorithm requires unitarity and 
assumes that the function registers are not measured. 

The probability of measuring the outcome p depends on which subgroup H is the 
hidden subgroup, but it is independent of the values / takes on the different cosets 
of H . That is, for any two functions / and /' having the same hidden subgroup H, the 
probabilities of measuring p are the same. We may therefore let Prob [K^ \ H] denote the 
probability that p is the outcome of measuring the first register of |Wfi na i), conditioned 
on the hidden subgroup being H . Theorem|2]follows. 

2.2 An exact algorithm 

We next use amplitude amplification to make our algorithm exact. This requires the 
ability to compute exactly the conditional probabilities Prob[X A1 |i7] without using the 
oracle. One method for computing Prob[X A1 |iJ] is to pick an arbitrary function / that 
is strictly i7-periodic, and simulate the quantum computation of Test on oracle / with 
a classical computer. Note that the classical computer implements arithmetic on exact 
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real numbers. However, neither this nor the high complexity of the algorithm is rel- 
evant to our proof of low query complexity. For this purpose we only need to know 
that the appropriate unitary transformations between queries exist. Thus, our quan- 
tum algorithm runs in exponential time, but uses only polynomially many queries in 
any model allowing arbitrary one-qubit and two-qubit gates, where each gate is given 
(implicitly) via the result of a classical computation. This model is of course not real- 
istic, but it suffices to rule out easy query complexity lower bounds, as discussed in the 
Introduction. 

Let Yi U Y| be any partitioning of the set of subgroups {Ki, . . . , K r }. The al- 
gorithm Test of the previous subsection succeeds in identifying the hidden subgroup 
with high probability. We now describe a new algorithm Exact Test that merely distin- 
guishes between the two above sets of subgroups, but does so with known and desirable 
probabilities. 

Lemma 6 The probability that the outcome of a measurement of the ancilla qubit of 
the state Exact Test (l^init) ® |0)) is 1 is | if the hidden subgroup H is in Y&, and it is 
j if H is in Yi. 

Before we describe the algorithm Exact Test, let M be an r x r matrix over [0, 1] 
with each row and column indexed by a subgroup. Let entry (H, K^) of M be the 
conditional probability Probf/^li/] that a measurement of the first register of l^finai) 
yields the outcome p conditional on / being strictly iJ-periodic. 

Let s = \2 log(4r 3 )] 6 0(log 2 N) so that by Theorem^ any diagonal entry of M 
is at least 1 — \, and since the entries of any row of M sum to 1, any off-diagonal entry 
of M is between and ■ Thus, we can express M as M = I— A, where each entry of 

A has absolute value bounded by ^. It follows that M _1 = / + A + A 2 + A 3 H , 

subject to the convergence of Y = A + A 2 + A 3 + ■ • • , which we now show. By 
induction on i, each entry of A 1 has absolute value bounded by . Therefore, each 
entry of Y has absolute value bounded by Y^Li —tft — r (r-i) ■ 

Let y be any r x 1 column vector with entries from {-j, §} and with each row 
indexed by a subgroup. Set x = M~ 1 y. Then, since M~ x y = y + Yy, every entry of x 
is within 4 ^ 3 _ 1 - ) of the corresponding entry of y, and thus every entry of x is in [0, 1] 
for r > 4. 

Algorithm Exact Test acts on the initial state j^init) <8> |0), where the last register 
holds an ancilla qubit in state |0), and is defined as 

Exact Test = R • (Test <g> I). (4) 

First, it applies Test on the first part of the system. It then applies R, which, condition- 
ally on the output register holding the subgroup index p, rotates the ancilla qubit from 
|0) to \/l — x M |0) + va^t|l)- Because R = P M ® R M for projectors P M = \p)(p\ 
and certain qubit rotations R^, it can be implemented unitarily. The probability that a 
measurement of the ancilla qubit of the resulting state Exact Test (I^Mt) <8) |0)) yields 
a 1 is thus 

^^Prob^lJI,], 
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which, by definition of the column vector x, is equal to y v , where H v is the hidden 
subgroup. In other words, the probability of measuring a 1 depends only on the index 
of the hidden subgroup. Set y v = | if K v E Yj , and set y v = i if K v S Yi . Lemma|S] 
follows. 

Lemma[6]provides us with a method for distinguishing between two complemen- 
tary subsets of subgroups with probabilities | and j. Using amplitude amplifica- 
tion 1131 . we can alter those probabilities into being equal to and 1, and hence dis- 
tinguish between the two sets Y| and Yi with certainty. Applying binary search on 
the set of subgroups with various choices of Ya and Yi then yields the second half of 
Theorem^ 

3 Concluding remarks 

Let HSP denote the decision problem of determining if the hidden subgroup is non- 
trivial. Let Qe{V) denote the quantum query complexity of determining some decision 
problem V with certainty, and let Q\(V) denote the quantum query complexity of 
determining V with one-sided error. Then Q B (HSP) e 0(log 2 \G\) since it suffices 
to use one round of amplitude amplification, because binary search among subgroups 
is not needed (let Yj be the singleton containing only the trivial subgroup). Also 
Qi(HSP) G 0(log \G\) since we need to test only for the cyclic subgroups, of which 
there are at most \G\, and then use one round of amplitude amplification for the case 
where the subgroup is trivial. If the subgroup is non-trivial, the algorithm may output 
an incorrect answer and thus the algorithm has one-sided error. 

The technique to construct exact quantum algorithms presented here relies on the 
property that we can compute the conditional probabilities with arbitrary precision. The 
technique seems to be applicable both to proving lower bounds as well as to designing 
efficient algorithms. It can rule out easy lower bounds for exact quantum computation, 
or it can be used to give simple and efficient exact quantum algorithms for problems 
for which the number of distinct success probabilities is polynomially bounded in the 
running time of the given bounded-error algorithm. 
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